CVE-2018-12296 Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST r...
HighCVSS 7.5
EPSS 11.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| seagate nas os | = 4.3.15.1 | No fix listed |
References
- blog.securityevaluators.com exploit third-party-advisory